Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Defender SmartScreen is hurting independent developers

getimageview.net

Post reply on HN
Print view View original

81–90 of 243 posts

Re: Microsoft Defender SmartScreen is hurting independent developers

#81

Post by WorldMaker »

Anon4Now wrote: post #27
skrebbel wrote: post #6

Earlier quoted context omitted.

Back, how? I don't disagree with the gist of this article, but that SmartScreen window has looked like that for many, many years. It's not new, nothing is back. Microsoft was never fantastic. The only thing that's new about this article is the bit about WinGet, which is so beta that it's hard to assume that its "SmartScreen means malware" behavior will remain like that. I do agree with it btw, it's just like how Gmai…

> but that SmartScreen window has looked like that for many, many years It changed a year or two ago. The "Run Anyways" button used to be on the main dialog. Now the user has to click the "More Info" button to see that option.

That particular dialog has been the same since Windows 10's launch, though it is "adaptive" in that as the reputation slowly builds it will show the Run Anyways button at something like "medium reputation".

Re: Microsoft Defender SmartScreen is hurting independent developers

#82

Post by Wowfunhappy »

jaquers wrote: post #54

I can certainly empathize with the author. How many executions are we talking about though? 10, 100, 1000? Seems like a dev w/ a new certificate could post a build of said application to a dev-friendly space to "bootstrap" the process. Certainly not practical in many scenarios, but that's why I was curious about how many it takes.

I don't think it's such a bad system either, but the certificates themselves should be much cheaper, if not free. I mean, they don't even do anything until a critical mass of users lets the app through smart-screen.

Re: Microsoft Defender SmartScreen is hurting independent developers

#83

Post by ebg13 »

fh973 wrote: post #77
ebg13 wrote: post #67

Earlier quoted context omitted.

> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Stop. Reasons for doing it at all are bullshit. If you want to evaluate the software, do that. I'll happily hand you the source code from GitHub and the build chain on AppVeyor so you can watch the executables being compiled. If you want to give me a way to mark my applications so that users know that they're picking u…

Not that simple to just pay. You need an EV certificate ( https://en.m.wikipedia.org/wiki/Extended_Validation_Certific... ), which in turn needs a verified business address. Not a good plan to distribute malware without going through the effort of faking a legitimate business aswell.

Oh, yes, so we're supposed to believe that malware outfits bringing in millions of dollars a year in illicit profit can't afford to set up front organizations.

And it doesn't even have to be fake! You could be Zoom! Or Avast! Or Trend Micro! Or Sony! Or Lenovo!

The only person in this story who doesn't have a business address is me.

Re: Microsoft Defender SmartScreen is hurting independent developers

#84

Post by [deleted] »

fh973 wrote: post #77
ebg13 wrote: post #67

Earlier quoted context omitted.

> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Stop. Reasons for doing it at all are bullshit. If you want to evaluate the software, do that. I'll happily hand you the source code from GitHub and the build chain on AppVeyor so you can watch the executables being compiled. If you want to give me a way to mark my applications so that users know that they're picking u…

Not that simple to just pay. You need an EV certificate ( https://en.m.wikipedia.org/wiki/Extended_Validation_Certific... ), which in turn needs a verified business address. Not a good plan to distribute malware without going through the effort of faking a legitimate business aswell.

[deleted]

Re: Microsoft Defender SmartScreen is hurting independent developers

#86

Post by acaloiar »

gregmac wrote: post #44

I get the sentiment here, it's very annoying for developers (including me). Establishing trust is very hard problem, though. Let's move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs…

> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation?

Microsoft can recognize that pay-to-play certificates are merely assets owned by developers; not developer identities. Microsoft needs to manage identity relationships with developers in a way that is indepdent of certificate aquisition and expiry.

The certificates themselves are merely an implementation detail of identity.

With that said, I don't condone the corporate gate-keeping of software development and recommend developers not contribute to any platform that requires indie developers to pay to become a part of the ecosystem. Long live open source.

Re: Microsoft Defender SmartScreen is hurting independent developers

#87

Post by fh973 »

falcolas wrote: post #76
kbenson wrote: post #15

Earlier quoted context omitted.

Eh, honestly, that's what getting an SSL cert used to be like 15 years ago. They can knock it all they want, but really, the process functioned pretty much as expected. Like a lock on your front door, the purpose is not to prevent unwanted people from ever getting inside (no lock will ever accomplish that), but to both make it take long enough the likelihood of being noticed is high, and to put enough hurdles in plac…

Funny how Let’s Encrypt is so popular because it doesn’t inconvenience people, and as a result more websites than ever have been secured, to the betterment of society.

There is a huge difference of what kind of identity is established: Let's Encrypt tells you basically that you are actually talking to the right server, whereas EV certs for signing binaries tell you which company that actually exists in the real world owns the certificate.

Re: Microsoft Defender SmartScreen is hurting independent developers

#88

Post by criddell »

ebg13 wrote: post #71
smacktoward wrote: post #70

Earlier quoted context omitted.

Every single person who installed Bonzi Buddy thought they were getting it from a good source.

Bonzi Buddy, as a money making enterprise, would have paid for a signing certificate as a cost of business. This does not save you from Bonzi Buddy.

Sure, Bonzi Buddy might not be the best example, but you get his point. People just click through dialogs to close them without thinking about what they are clicking.

Re: Microsoft Defender SmartScreen is hurting independent developers

#89

Post by gorkish »

What this really does is train users to bypass protections. As anyone who has owned a mac can attest, I now basically think nothing of the potential perils of doing "right click -> open -> ok" because I have to do it ALL THE TIME.

It's getting to the point where it's the same on windows. More info -> run anyway is becoming a useless annoyance.

I would note that at one point SSL certificates were kind of in the same boat. Users clicked through web warnings as a matter of course. The thing that changed is that we were able to reduce the financial barrier to certs to literally $0. If the same can be done for this nonsense, we will be in much better shape.

I have already made my choice on risk when I chose to download the software from the developer and execute it. A prompt for a first time trust might be the limit of what I'm OK with including, but any stronger warning or making it difficult to proceed is really only reasonable to do if some 3rd party is compromising a choice I have already made.

Re: Microsoft Defender SmartScreen is hurting independent developers

#90

Post by chooseaname »

echelon wrote: post #13

More walled gardens. Hooray. This is why we need WASM and web-first development. If the platforms won't empower us to develop and distribute without levying their tax, we need to take our business back to the open web and spend our money on making it the best platform. Besides, it's a nightmare to have to develop for every single platform when the web is universal. Platforms should pay the cost of making things work…

> This is why we need WASM and web-first development.

This is why we have Linux. Personally, I don't want to live in a web-first world. I don't want everything I do on a computer to have to have internet access. And I certainly don't want the browser to be my OS.

Post reply on HN